This invention relates generally to a system and a method for protecting computer storage systems from being accessed by unauthorized computers. More particularly, this invention relates to a system and a method that provides for periodic verification of computers sending and receiving data to and from storage devices, storage servers, or storage systems over a computer network.
Traditionally, computers store data on storage devices, which can be located internally or externally to a computer enclosure. Computers may have access to many storage devices, servers, or systems, some of which are internal and some of which are external. When a storage device is accessed by a computer located within the same enclosure, there is little or no risk of unauthorized access of the stored data by another computer, because the data are not transmitted over a computer network. This configuration provides good security because no other computer can read the data, but does not provide the ability for other computers to directly utilize the same storage device. When a storage device is implemented into a storage area network (SAN), there is an increased risk of unauthorized access of the stored data. The increased risk is caused by the storage device being directly or indirectly connected to many computers over a computer network, such as the Internet, local area networks (LANs), metropolitan area networks (MANs), or wide area networks (WANs).
In a storage area network or similar type of network, there will be more than one computer that can have direct access to one or more storage devices. There may also be more than one storage device and the storage device may be controlled by a computer. Because the primary purpose of storage systems is to provide storage, they are typically not equipped with security systems. The computers are connected to the storage systems, storage devices, and servers by a network, which may be large and accessed by many authorized and unauthorized computers. In the case of SANs and other types of networks, there exists a need to provide a security system to prevent unauthorized access of the stored data.
Various techniques are available to prevent unauthorized access to computer data. The most common techniques are encryption and authentication protocols. Typically, encryption involves an initiating computer and a servicing computer with a shared secret key and complex algorithms used to encode the data using the shared secret key. Encryption considerably decreases data throughput and increases processing effort. Some encryption protocols required additional hardware to be used, adding to the expense of the system. Authentication handshaking protocols involve using a shared secret key to establish the communications link between an initiating computer and a servicing computer. Authentication alone does not provide periodic verification of the initiating computer's identity.
Spoofing is one type of unauthorized access to data in which an invading computer masquerades as the initiating computer after the initiating computer has established a communication link through the authentication protocol with the storage device. The invading computer is able to steal data from the storage device because the invading computer is able to forge its identity as a valid computer.
What is needed is a way to check for unauthorized access of a storage device or system and provides periodic verification of a computer during data transfer between the computer and the storage device or system, while not decreasing data throughput.